# Sync directly between trusted devices.

Source: https://9secure.io/docs/sync/

If this text resource cannot be retrieved, use the HTML source above. [Documentation (text)](https://9secure.io/docs/index.txt) ([HTML](https://9secure.io/docs/))

All platform instructions are included. Follow the labels for your device; platform-specific steps are alternatives, not additional steps.

9Secure supports multi-way Sync: selected vaults synchronize in both directions across trusted devices through mutually authenticated, end-to-end encrypted local-network sessions.

Each device can exchange changes with its paired peers for subscribed vaults. No device has to act as the primary copy. 9Core currently bounds Sync All and each vault's peer list at 1,024 peers.

## Meet the local-network requirements

[Section source](https://9secure.io/docs/sync/#before-you-start)

- Keep both devices unlocked, awake, and on the same local network.
- Allow local-network discovery when the operating system asks.
- Turn on **Sync** on both devices. This creates or loads each device's Sync identity.
- Keep enough free storage for the selected vaults and attachments.

Native apps use mDNS/DNS-SD to discover nearby devices advertising `_9secure._tcp`, then connect directly over TCP. Discovery locates devices; it does not authenticate them. 9Core provides mutual authentication and end-to-end encryption over the app's connection, independent of transport. Current apps support local-network Sync only, without a 9Secure account, cloud vault, hosted relay, or remote internet Sync.

## Pair devices

[Section source](https://9secure.io/docs/sync/#pair-devices)

1. Open **Sync** on both devices.
2. Select **Pair a Device** or **Pair Device**.
3. Under **Local Network Devices**, select **Pair** beside the intended device.
4. On the chooser, select the number shown on the other device.
5. Compare both screens in person. Do not confirm a number received through a message or supplied by someone else.
6. Select **Confirm** on both devices only after the number matches.

The six-digit number is a short authentication check inside a cryptographic pairing handshake. Pairing finishes only after bilateral confirmation and acknowledgement. Cancel and restart if the names or numbers do not match.

After a pairing error, read the message and select **Retry** beside the discovered device. Compare the numbers and confirm on both devices again.

**Android:** Open Sync's **More options** menu for **Pair Device**, **Available Vaults**, or **Turn Off Sync**.

## Review device trust

[Section source](https://9secure.io/docs/sync/#verify-devices)

Paired devices appear under **My Desktop Devices** or **My Mobile Devices**. A device card remains visible while offline so you can review trust and subscriptions.

- **Local Network** means the paired peer is currently detected on the network, not that a Sync has completed.
- **Not Detected** means it remains trusted but is not currently discovered.
- **Forget Device** removes the trusted peer and turns off its local vault subscriptions. It does not delete your local vaults.

To forget a device, open its more-actions menu, select **Forget Device**, then confirm or cancel. You must pair again before syncing with that device.

Pairing establishes device identity. Vault access is still controlled per vault. If the app reports that pairing needs repair, follow its instructions to forget the old trust record where it remains before pairing again. A connection timeout alone is not a reason to discard trust.

## Choose vault subscriptions

[Section source](https://9secure.io/docs/sync/#select-vaults)

Each paired-device card contains one switch per visible vault. Turn on only the vaults that should synchronize with that device.

A subscription transfers complete vault contents inside the encrypted Sync session, including items, history state, and attachments. It is not a field-level sharing rule. Keep separate vaults when different devices need different data.

Passkeys and Authenticator setups travel with their Logins between Windows, macOS, iOS, and Android. To use a received passkey, enable 9Secure as the receiving device's provider and check the [passkey requirements](https://9secure.io/docs/items/#passkeys).

## Run and verify Sync

[Section source](https://9secure.io/docs/sync/#first-sync)

1. Enable the intended vault switches on the paired-device card.
2. Select **Sync** for one reachable device, or **Sync All** for all eligible devices.
3. Keep the devices awake until the status reports completion.
4. Open each expected vault on the receiving device.
5. Verify representative items and attachments before relying on the receiving copy.

**Sync All** changes to **Cancel Sync** during an active run. 9Secure processes eligible peers in sequence and makes additional passes when needed to propagate changes learned from other peers. Device actions and subscription switches are disabled while Sync is running.

A partial-completion result means only the reported successful devices finished. Review failed or offline devices and retry after addressing the reported issue.

## Understand convergence and conflicts

[Section source](https://9secure.io/docs/sync/#sync-behavior)

9Core reconciles the current materialized state of the whole vault. Most concurrent changes converge deterministically using stamped updates from each device. Deleted fields and attachments retain tombstones so an older peer does not silently recreate them.

History entries merge separately by operation ID. History is useful for inspection, but it is not the authority for current Sync state and does not provide general undo or point-in-time restore.

If two devices produce different values with the same update stamp, 9Secure reports a Sync conflict instead of choosing silently. Open the named item, edit and save the affected field on one device to create a new update, then Sync again.

## Remove locally or delete everywhere

[Section source](https://9secure.io/docs/sync/#remove-or-delete)

Choose deletion scope carefully:

- Local removal deletes the managed copy from this device and keeps metadata that can make the vault available again from a subscribed paired device.
- **Delete across all synced devices** creates a global deletion request. Other devices must authenticate it and can show **Delete Vaults Everywhere?** with **Keep Vaults** or **Delete Everywhere**.

Global deletion cannot be undone through the app. Confirm that a tested independent recovery copy exists before choosing it.

**Windows and macOS**

The desktop **Delete Vault** dialog includes **Delete across all synced devices**, off by default.

**iOS and iPadOS**

iOS offers **Remove from This iPhone** or **Delete on All Synced Devices**.

**Android**

Android offers **Remove from This Device** or **Delete on All Synced Devices**.

## Download an available vault

[Section source](https://9secure.io/docs/sync/#available-vaults)

**Available Vaults** lists known vaults with an authenticated download source from a subscribed paired device. These can include locally removed vaults or eligible vaults whose local files are missing. The source must be reachable to download; an earlier advertisement is not proof it is still online.

1. Open **Available Vaults**.
2. Select **Download to This Device** beside the vault.
3. Wait for the follow-up Sync to finish.
4. Open the vault and verify its contents.

A globally deleted vault does not appear as available.

## Lock, suspend, and turn off Sync

[Section source](https://9secure.io/docs/sync/#connectivity)

Locking stops active Sync runtime. Suspend or background behavior follows the platform's lock setting. After unlock or resume, Sync restarts only if its saved enabled preference remains on.

**Turn Off Sync** stops discovery, pairing activity, transport, and active Sync. It does not automatically forget existing paired-device trust records.

## Cross-device recovery copies

[Section source](https://9secure.io/docs/sync/#recovery-copies)

Completed Sync provides a cross-device backup against losing a single device. Synchronize every vault you want covered and verify its contents on the receiving device. That device keeps its own encrypted copies and unlocks them through its own keyring, even if the original device is unavailable.

Edits and deletions can propagate. To also preserve an independent earlier state, keep an encrypted copy on a separate drive or device using the platform-supported options in [Security Architecture](https://9secure.io/docs/security/#recovery-backups).

## Troubleshoot without weakening trust

[Section source](https://9secure.io/docs/sync/#troubleshooting)

1. Read both the network status and the operation or error message. Network readiness, device discovery, and completed Sync are separate states.
2. If Sync requests an update, update the device or devices named in the message and retry. A timeout or disconnect alone does not establish a version mismatch.
3. Keep both apps unlocked and confirm Sync is on.
4. Confirm both devices are on the same local network and that local discovery is allowed by the OS and firewall.
5. Reopen pairing on both devices and wait for discovery. Do not bypass the number comparison.
6. Verify the vault subscription switch on both relevant device cards.
7. Check free storage before retrying a large vault or attachment transfer.
8. For a reported field conflict, edit and save that field on one device, then Sync again.
9. Use **Forget Device** and re-pair when instructed to replace an existing trust record, or when intentionally replacing it. If removal fails, retry it before pairing again.

A failed connection does not expose plaintext vault contents to unauthenticated network observers, but it also does not prove that Sync completed. A trusted paired endpoint can decrypt content it receives. Verify received data.